21–30 of 316 posts
That’s the problem with a lot of security recommendations. Often they are very inconvenient.
> I have over 1400 passwords, stored securely in a password manager. Is the password manager not a single point of failure in this model?
Yes but you can protect your password manager with one incredibly secure password. For example, 20 characters.
The company I work for requires a password change every 60 days and a history of 9 passwords. Every other password I have in my 1Password so its ultra strong and secure (I use a 5 word passphrase). For my login password I just change the last digit in a loop between 0 and 9.
The password requirements at my job are, in my opinion, insane. It has to be a specified length (an exact number of characters, no more, no less), can't contain any 3+ character words found in a dictionary, and a few other requirements like at least one capital letter and at least one number. And it has to change every three months. So yes, when I have to change my password I end up changing a single character or dig…
(+ (CAR hn) 1)
And the variation:
(LET ((hn '(1 2 3))) (+ (CAR hn) 1)
This one works as well :)
STRCPY(str2, str1)
You might be able to even meet the length requirements by padding with some comment characters. You might even use the comment char from a different language than the one the statement is in teeheehee.
Some use chess moves, others poetry lines, why not use code ;)
Only 49%? That's way lower than I would have expected, I wonder if there were people in the survey that weren't willing to admit it?
Companies should provide a password manager solution for their employees, if they care. They make us change it every 30-90 days, tell us not to write it down anywhere, and don't want us to just add '1' on the end, but expect us to memorize it. I'm not going to pony up my own money for a password manager to use at work and try to make it work there. I pay for one for my own use and it stays for personal use.
This should not be a surprise, as this supports the NIST's revised recommendations (from June 2017!) that passwords should not expire [0], because it actually leads to less-secure passwords for this exact reason. Furthermore, many corporate systems do not integrate well with password managers, such as when first logging in to your system in the morning. This means that the password is likely to be one of the few that…
Only 49%? That's way lower than I would have expected, I wonder if there were people in the survey that weren't willing to admit it?
Nah, the other half just write it down on a sticky note and place it on their monitors.
The company I work for requires a password change every 60 days and a history of 9 passwords. Every other password I have in my 1Password so its ultra strong and secure (I use a 5 word passphrase). For my login password I just change the last digit in a loop between 0 and 9.
Pro tip: With a history of 9 passwords, change your password 10 times every time you change it until you loop back to the original. That way you can use the same password indefinitely.
If you try to change it again during the 30-60 minutes propagation time, then you need to try even more passwords passwords. Too complex to deal with.